Analysis

  • max time kernel
    0s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2024 09:54

General

  • Target

    REVISED INVOICE.exe

  • Size

    983KB

  • MD5

    8274b1a41b53bf35e0b4330a20010d4c

  • SHA1

    0b263f01dd3e10389cd4fe6575d114ea301ee874

  • SHA256

    d2320e5704e90bc713c59a0521bacf04ca5751c2481e1dd4e3a95494981d867c

  • SHA512

    727ed4fe93c9f0da19df61b81d3f92a9ddc9b6680b2ac841e1ed3ed37bbbe7ecc4a628dfddf31429d2fb5034edd6bc7f742a84f6e76fe7f7401dcd98ea3ec644

  • SSDEEP

    12288:KBu+je2mGYUNpeqzfAOKUXWkP/8KYfNrnEoYhJLAMhuwIm/toWyqTnoXnPolxsq8:D+63cWqv3nANr8xAGuwIm/yWiopvC9wG

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\REVISED INVOICE.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISED INVOICE.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:3692
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\Admin\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4372
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
          PID:3080

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4i0kov0g.dsx.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\fona\Kvit\Hyperclimax.Com

      Filesize

      55KB

      MD5

      6ac57b58205d75aee6380c3c6a8ef2a2

      SHA1

      466480b2a43b6c6dd95253849acaafcef82ca2b3

      SHA256

      f79002317d2a561e589e0006dd549d39c71488689ce772b15f84f393926a2786

      SHA512

      ea0dea24679edb7b4d10a62e23d52bf8102338bea90957f27adc92228a54bb0b49bb710b2ed9a159b48eb5ad1a353fdcefb311a2569a82d1bed17f8f4e7782be

    • C:\Users\Admin\AppData\Local\fona\Kvit\Smudgeproof.Spe

      Filesize

      315KB

      MD5

      02093bf4e23f0dc4ed17ace33f3071c3

      SHA1

      ff8e59ee5eb06847411f0f11319081acc6510f8c

      SHA256

      2f9c4d11c84da12fc93d685d8a1cf99f0b7c9fe42d50bcd56e08d6e4b2a8014b

      SHA512

      41f9d4a882d570da60724494d64dab81c2cacab90b90b44ce5ae4726bd6dfaabf5c3e6abf358575b3f321b62dbd7fcbc0788c49c135f511e5be7826bda6426ca

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\depoh.lnk

      Filesize

      876B

      MD5

      c87ab8bcaa63a6064aa01de3f82668f7

      SHA1

      8ec92b2666bb9113d3543c8184fde8a1a09bde4e

      SHA256

      145b6e14ecdf155dbc9c2a7aee435146a08185b9ed97aef56d9ee6768df36eb2

      SHA512

      4e4b7a369f9171e5fad8b0a45f6a358cb3979d84f340c82ef470af81b7c33186ce7747e5b8bf69108e99be5817b48e4bdee967a94717e19d703f49d2a823ccaf

    • memory/3080-248-0x0000000024B50000-0x0000000024BE2000-memory.dmp

      Filesize

      584KB

    • memory/3080-249-0x0000000024B00000-0x0000000024B0A000-memory.dmp

      Filesize

      40KB

    • memory/3080-246-0x0000000024A50000-0x0000000024AA0000-memory.dmp

      Filesize

      320KB

    • memory/3080-245-0x0000000025200000-0x00000000253C2000-memory.dmp

      Filesize

      1.8MB

    • memory/3080-242-0x0000000000CA0000-0x0000000000CE8000-memory.dmp

      Filesize

      288KB

    • memory/3080-241-0x0000000000CA0000-0x0000000001EF4000-memory.dmp

      Filesize

      18.3MB

    • memory/3080-243-0x0000000024580000-0x000000002461C000-memory.dmp

      Filesize

      624KB

    • memory/4372-214-0x00000000077B0000-0x00000000077DA000-memory.dmp

      Filesize

      168KB

    • memory/4372-196-0x0000000007600000-0x0000000007632000-memory.dmp

      Filesize

      200KB

    • memory/4372-192-0x0000000006730000-0x0000000006752000-memory.dmp

      Filesize

      136KB

    • memory/4372-193-0x0000000007810000-0x0000000007DB4000-memory.dmp

      Filesize

      5.6MB

    • memory/4372-188-0x00000000061C0000-0x00000000061DE000-memory.dmp

      Filesize

      120KB

    • memory/4372-191-0x00000000066E0000-0x00000000066FA000-memory.dmp

      Filesize

      104KB

    • memory/4372-190-0x0000000007170000-0x0000000007206000-memory.dmp

      Filesize

      600KB

    • memory/4372-195-0x0000000008440000-0x0000000008ABA000-memory.dmp

      Filesize

      6.5MB

    • memory/4372-197-0x0000000070770000-0x00000000707BC000-memory.dmp

      Filesize

      304KB

    • memory/4372-210-0x0000000007670000-0x0000000007713000-memory.dmp

      Filesize

      652KB

    • memory/4372-211-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-212-0x0000000007770000-0x000000000777A000-memory.dmp

      Filesize

      40KB

    • memory/4372-215-0x00000000077E0000-0x0000000007804000-memory.dmp

      Filesize

      144KB

    • memory/4372-177-0x0000000005320000-0x0000000005386000-memory.dmp

      Filesize

      408KB

    • memory/4372-213-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-209-0x0000000007640000-0x000000000765E000-memory.dmp

      Filesize

      120KB

    • memory/4372-199-0x0000000070D20000-0x0000000071074000-memory.dmp

      Filesize

      3.3MB

    • memory/4372-216-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-198-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-189-0x00000000065D0000-0x000000000661C000-memory.dmp

      Filesize

      304KB

    • memory/4372-218-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-187-0x0000000005B90000-0x0000000005EE4000-memory.dmp

      Filesize

      3.3MB

    • memory/4372-220-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-221-0x00000000742FE000-0x00000000742FF000-memory.dmp

      Filesize

      4KB

    • memory/4372-222-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-223-0x0000000008AC0000-0x000000000D137000-memory.dmp

      Filesize

      70.5MB

    • memory/4372-224-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-225-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-226-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-228-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-176-0x00000000052B0000-0x0000000005316000-memory.dmp

      Filesize

      408KB

    • memory/4372-175-0x0000000005210000-0x0000000005232000-memory.dmp

      Filesize

      136KB

    • memory/4372-173-0x00000000053A0000-0x00000000059C8000-memory.dmp

      Filesize

      6.2MB

    • memory/4372-174-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-172-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4372-171-0x0000000004C10000-0x0000000004C46000-memory.dmp

      Filesize

      216KB

    • memory/4372-170-0x00000000742FE000-0x00000000742FF000-memory.dmp

      Filesize

      4KB